[nawitus]

However, GDPR is a regulation, not a directive. I haven't seen that countries pass their own implementation of it.

[x0x0]

Each country-specific privacy org gets leeway around rules like legitimate interest.